Critical vulnerability archive — page 348

Zend1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2021-47667 · Zend ZendTo

An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote atta…

EPSS 36%public exploit CVSS 10.0

bentoml1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-27520 · bentoml BentoML

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

EPSS 41%public exploit CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-28146 · mitre

Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_ur…

EPSS 11%public exploit CVSS 9.8

TOTOLINK1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-3249 · TOTOLINK A6000R

TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection

EPSS 3%public exploit CVSS 9.8

Kentico1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2025-32370 · Kentico Xperience

Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, bec…

EPSS 2%public exploit CVSS 9.8

PHP Group1 vulnerability on this pageMax CVSS 9.2Priority 52KEV 0

CVE-2024-11235 · PHP Group PHP

Reference counting in php_request_shutdown causes Use-After-Free

EPSS 1%public exploit CVSS 9.2

qinguoyi2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-3266 · qinguoyi TinyWebServer

qinguoyi TinyWebServer http_conn.cpp stack-based overflow

EPSS 0.8%public exploit CVSS 9.8

CVE-2025-3268 · qinguoyi TinyWebServer

qinguoyi TinyWebServer http_conn.cpp improper authentication

EPSS 0.8%public exploit CVSS 9.8

ageerle2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3199 · ageerle ruoyi-ai

ageerle ruoyi-ai API Interface SysModelController.java improper authorization

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3202 · ageerle ruoyi-ai

ageerle ruoyi-ai SysNoticeController.java improper authorization

EPSS 0.5%public exploit CVSS 9.1

code-projects6 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3307 · code-projects Blood Bank Management System

code-projects Blood Bank Management System reset.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3306 · code-projects Blood Bank Management System

code-projects Blood Bank Management System don.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3308 · code-projects Blood Bank Management System

code-projects Blood Bank Management System viewrequest.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3309 · code-projects Blood Bank Management System

code-projects Blood Bank Management System campsdetails.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3310 · code-projects Blood Bank Management System

code-projects Blood Bank Management System delete.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3209 · code-projects Patient Record Management System

code-projects Patient Record Management System add_patient.php sql injection

EPSS 0.6%CVSS 9.8

projectworlds5 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3182 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System getschedule.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-3185 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System patientupdateprofile.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-3183 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System patientupdateprofile.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3184 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System profile.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3186 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System invoice.php sql injection

EPSS 0.6%public exploit CVSS 9.8

zhangyanbo20071 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3241 · zhangyanbo2007 youkefu

zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference

EPSS 0.7%public exploit CVSS 9.8

itsourcecode2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3195 · itsourcecode Online Blood Bank Management System

itsourcecode Online Blood Bank Management System bbms.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3245 · itsourcecode Library Management System

itsourcecode Library Management System Forgot.java search sql injection

EPSS 0.5%public exploit CVSS 9.8

PHPGurukul15 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3187 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3188 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System add-notes.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3213 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System view-note.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3216 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System password-recovery.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3217 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System registration.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3220 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System dashboard.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3231 · PHPGurukul Zoo Management System

PHPGurukul Zoo Management System aboutus.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3238 · PHPGurukul Online Fire Reporting System

PHPGurukul Online Fire Reporting System search-request.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3239 · PHPGurukul Online Fire Reporting System

PHPGurukul Online Fire Reporting System edit-guard-detail.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3240 · PHPGurukul Online Fire Reporting System

PHPGurukul Online Fire Reporting System search.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3258 · PHPGurukul Old Age Home Management System

PHPGurukul Old Age Home Management System search.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3265 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System add-category.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3311 · PHPGurukul Men Salon Management System

PHPGurukul Men Salon Management System about-us.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3235 · PHPGurukul Old Age Home Management System

PHPGurukul Old Age Home Management System profile.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-3242 · PHPGurukul e-Diary Management System

PHPGurukul e-Diary Management System search-result.php sql injection

EPSS 0.5%public exploit CVSS 9.8

xujiangfei1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3254 · xujiangfei admintwo

xujiangfei admintwo add server-side request forgery

EPSS 0.6%public exploit CVSS 9.8

CodeAstro1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-3204 · CodeAstro Car Rental System

CodeAstro Car Rental System returncar.php sql injection

EPSS 0.5%public exploit CVSS 9.8

glenwpcoder1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2025-2941 · glenwpcoder Drag and Drop Multiple File Upload for WooCommerce

Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move

EPSS 2%CVSS 9.8

Bitdefender1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-2244 · Bitdefender GravityZone Console

Insecure PHP deserialization issue in GravityZone Console (VA-12634)

EPSS 1%CVSS 9.8

pluggabl1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-13744 · pluggabl Booster for WooCommerce

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

EPSS 0.7%CVSS 9.8

tagDiv1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-13645 · tagDiv tagDiv Composer

TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

EPSS 0.7%CVSS 9.8

XTENDIFY1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-2798 · XTENDIFY Woffice CRM

Woffice <= 5.4.21 - Authentication Bypass via Registration Role

EPSS 0.7%CVSS 9.8

NiteoThemes1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2025-32118 · NiteoThemes CMP – Coming Soon & Maintenance

WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability

EPSS 0.7%CVSS 9.1

Favethemes1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-51800 · Favethemes Homey

WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

aiven1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-31480 · aiven aiven-extras

aiven-extras allows PostgreSQL Privilege Escalation through format function

EPSS 0.5%CVSS 9.1

shiptrack1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-31403 · shiptrack Booking Calendar and Notification

WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

The archive.