Critical vulnerability archive — page 319

knadh1 vulnerability on this pageMax CVSS 9.1Priority 53KEV 0

CVE-2025-49136 · knadh listmonk

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

EPSS 2%public exploit CVSS 9.1

Tenda2 vulnerabilities on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-5862 · Tenda AC7

Tenda AC7 setPptpUserList formSetPPTPUserList buffer overflow

EPSS 1%public exploit CVSS 9.8

CVE-2025-5863 · Tenda AC5

Tenda AC5 SetRebootTimer formSetRebootTimer stack-based overflow

EPSS 1%public exploit CVSS 9.8

VulDB5 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-5906 · code-projects Laundry System

code-projects Laundry System data missing authentication

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-5881 · code-projects Chat System

code-projects Chat System confirm_password.php sql injection

EPSS 0.6%public exploit CVSS 9.8

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-5913 · PHPGurukul Vehicle Record Management System

PHPGurukul Vehicle Record Management System search-vehicle.php sql injection

EPSS 0.6%public exploit CVSS 9.8

labring1 vulnerability on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2025-49131 · labring FastGPT

FastGPT Sandbox Vulnerable to Sandbox Bypass

EPSS 0.5%public exploit CVSS 9.9

Lablup1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-49652 · Lablup BackendAI

Improper access control allows arbitrary account creation

EPSS 0.4%public exploit CVSS 9.8

ManageEngine1 vulnerability on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2025-3835 · ManageEngine Exchange Reporter Plus

Remote Code Execution

EPSS 2%CVSS 9.6

mystyleplatform1 vulnerability on this pageMax CVSS 9.3Priority 43KEV 0

CVE-2025-48281 · mystyleplatform MyStyle Custom Product Designer

WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability

EPSS 1%CVSS 9.3

WilderForge1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2025-49013 · WilderForge WilderForge

WilderForge vulnerable to code Injection via GitHub Actions Workflows

EPSS 0.9%CVSS 10.0

PayU India1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-31022 · PayU India PayU India

WordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability

EPSS 0.8%CVSS 9.8

sonalsinha211 vulnerability on this pageMax CVSS 9.3Priority 41KEV 0

CVE-2025-47608 · sonalsinha21 Recover abandoned cart for WooCommerce

WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

EPSS 1%CVSS 9.3

Mikado-Themes3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-49295 · Mikado-Themes MediClinic

WordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-49296 · Mikado-Themes GrandPrix

WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-49297 · Mikado-Themes Grill and Chow

WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability

EPSS 0.6%CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-57190 · mitre

Erxes <1.6.1 is vulnerable to Incorrect Access Control.

EPSS 0.7%CVSS 9.8

CyberData2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-30515 · CyberData 011209 SIP Emergency Intercom

CyberData 011209 SIP Emergency Intercom Path Traversal

EPSS 0.6%CVSS 9.8

CVE-2025-30184 · CyberData 011209 SIP Emergency Intercom

CyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel

EPSS 0.5%CVSS 9.8

FantasticPlugins1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2025-32291 · FantasticPlugins SUMO Affiliates Pro

WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

g5theme1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-48126 · g5theme Essential Real Estate

WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability

EPSS 0.6%CVSS 9.8

Holest Engineering3 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2025-48123 · Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability

EPSS 0.5%CVSS 10.0

CVE-2025-48129 · Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-48122 · Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability

EPSS 0.4%CVSS 9.3

LoftOcean1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-49507 · LoftOcean CozyStay

WordPress CozyStay theme < 1.7.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

themeton4 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-31052 · themeton The Fashion - Model Agency One Page Beauty Theme

WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-31396 · themeton FLAP - Business WordPress Theme

WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-31398 · themeton PIMP - Creative MultiPurpose

WordPress PIMP - Creative MultiPurpose <= 1.7 - Deserialization of untrusted data Vulnerability

EPSS 0.6%CVSS 9.8

CVE-2025-31429 · themeton PressGrid - Frontend Publish Reaction & Multimedia Theme

WordPress PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data Vulnerability

EPSS 0.6%CVSS 9.8

Avaya1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2025-1041 · Avaya Avaya Call Management System

Avaya Call Management System RCE vulnerability

EPSS 0.5%CVSS 9.9

Honding Technology1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-5893 · Honding Technology Smart Parking Management System

Honding Technology Smart Parking Management System - Exposure of Sensitive Information

EPSS 0.5%CVSS 9.8

metalpriceapi1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2025-48140 · metalpriceapi MetalpriceAPI

WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

EPSS 0.4%CVSS 9.9

discourse1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-48877 · discourse discourse

Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe

EPSS 0.4%CVSS 9.8

pixelgrade1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2025-31039 · pixelgrade Category Icon

WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

EPSS 0.6%CVSS 9.1

SAP_SE1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2025-42989 · SAP_SE SAP NetWeaver Application Server for ABAP

Missing Authorization check in SAP NetWeaver Application Server for ABAP

EPSS 0.4%CVSS 9.6

Dmacroweb4 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-40654 · Dmacroweb DM Corporative CMS

SQL injection vulnerability in DM Corporative CMS

EPSS 0.4%CVSS 9.8

CVE-2025-40655 · Dmacroweb DM Corporative CMS

SQL injection vulnerability in DM Corporative CMS

EPSS 0.4%CVSS 9.8

CVE-2025-40656 · Dmacroweb DM Corporative CMS

SQL injection vulnerability in DM Corporative CMS

EPSS 0.4%CVSS 9.8

CVE-2025-40657 · Dmacroweb DM Corporative CMS

SQL injection vulnerability in DM Corporative CMS

EPSS 0.4%CVSS 9.8

facturaone1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-24767 · facturaone TicketBAI Facturas para WooCommerce

WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability

EPSS 0.4%CVSS 9.3

kamleshyadav1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-31424 · kamleshyadav WP Lead Capturing Pages

WordPress WP Lead Capturing Pages plugin < 2.6 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

Salesforce1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-43698 · Salesforce OmniStudio

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls fo…

EPSS 0.5%CVSS 9.1

ThimPress1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-48267 · ThimPress WP Pipes

WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability

EPSS 0.5%CVSS 9.1

woobewoo1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-31059 · woobewoo WBW Product Table PRO

WordPress WBW Product Table PRO plugin <= 2.2.6 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Alex Zaytseff1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-48141 · Alex Zaytseff Multi CryptoCurrency Payments

WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability

EPSS 0.3%CVSS 9.3

The archive.