The archive.

CVE-2025-28035 · mitre

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg functio…

CVE-2025-28036 · mitre

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg functi…

CVE-2025-29659 · mitre

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.

EPSS 2%public exploit CVSS 9.8

CVE-2025-28037 · mitre

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulne…

CVE-2025-28038 · mitre

TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx func…

CVE-2025-28039 · mitre

TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW funct…

CVE-2025-29660 · mitre

A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789.

CVE-2025-43946 · mitre

TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal).

CVE-2025-29287 · mitre

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a…

EPSS 0.8%public exploit CVSS 9.8

CVE-2023-44755 · mitre

Sacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php.

CVE-2025-28024 · mitre

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi

CVE-2025-43949 · mitre

MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute maliciou…

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-28104 · mitre

Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.

EPSS 0.4%public exploit CVSS 9.1

CVE-2023-43958 · mitre

An arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php of Hospital Management System v4.0 allow…

EPSS 1%CVSS 9.8

CVE-2024-40446 · mitre

An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script

EPSS 0.8%CVSS 9.8

CVE-2023-44752 · mitre

An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-…

EPSS 0.7%CVSS 9.8

Infodraw1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2025-43928 · Infodraw Media Relay Service

In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traver…

EPSS 0.9%public exploit CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2025-3783 · SourceCodester Web-based Pharmacy Product Management System

SourceCodester Web-based Pharmacy Product Management System add-product.php unrestricted upload

EPSS 1.0%public exploit CVSS 9.8

markparticle3 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3845 · markparticle WebServer

markparticle WebServer buffer.cpp HasWritten buffer overflow

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-3846 · markparticle WebServer

markparticle WebServer Registration httprequest.cpp sql injection

CVE-2025-3847 · markparticle WebServer

markparticle WebServer Login httprequest.cpp sql injection

VulDB2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3800 · VulDB

WCMS AnonymousController.php sql injection

CVE-2025-3799 · VulDB

WCMS AnonymousController.php sql injection

AdeptLanguage1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-32958 · AdeptLanguage Adept

Adept exposed the GITHUB_TOKEN in workflow run artifact

PHPGurukul4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3819 · PHPGurukul Men Salon Management System

PHPGurukul Men Salon Management System search-appointment.php sql injection

CVE-2025-3827 · PHPGurukul Men Salon Management System

PHPGurukul Men Salon Management System forgot-password.php sql injection

CVE-2025-3828 · PHPGurukul Men Salon Management System

PHPGurukul Men Salon Management System view-appointment.php sql injection

CVE-2025-3829 · PHPGurukul Men Salon Management System

PHPGurukul Men Salon Management System sales-reports-detail.php sql injection

wix-incubator1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-3841 · wix-incubator jam

wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-29953 · Apache Software Foundation Apache ActiveMQ NMS OpenWire Client

Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass

EPSS 2%CVSS 9.8

pytorch1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-32434 · pytorch pytorch

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

EPSS 2%CVSS 9.8

LiquidThemes1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-1093 · LiquidThemes AI Hub - Startup & Technology WordPress Theme

AIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image

EPSS 1%CVSS 9.8

ASUS1 vulnerability on this pageMax CVSS 9.2Priority 41KEV 0

CVE-2025-2492 · ASUS Router

An improper authentication control vulnerability exists in AiCloud.

EPSS 1%CVSS 9.2

Codeflist1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2021-4455 · Codeflist Wordpress Plugin Smart Product Review

Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload

EPSS 0.8%CVSS 9.8

Yokogawa Electric Corporation1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-1863 · Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders

Insecure default settings for recorder products

EPSS 0.8%CVSS 9.8

Formulatrix1 vulnerability on this pageMax CVSS 9.2Priority 40KEV 0

CVE-2025-0632 · Formulatrix Rock Maker Web

Local File Inclusion (LFI) leading to sensitive data exposure

EPSS 0.9%CVSS 9.2

panhainan1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-3842 · panhainan DS-Java

panhainan DS-Java FileUpload.java uploadUserPic.action code injection

EPSS 0.7%CVSS 9.8

traefik1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2025-32431 · traefik traefik

Traefik has a possible vulnerability with the path matchers

EPSS 0.9%CVSS 9.1

Edge-Themes1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-3278 · Edge-Themes UrbanGo Membership

UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation

GoBGP1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-43973 · GoBGP GoBGP

An issue was discovered in GoBGP before 3.35.0.