Critical vulnerability archive — page 349

CrushFTP1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-31161 · CrushFTP CrushFTP

CrushFTP Authentication Bypass Vulnerability

KEV · due 28 Apr ransomware use EPSS 100%public exploit SSVC act CVSS 9.8

Gladinet1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-30406 · Gladinet CentreStack

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

KEV · due 29 Apr EPSS 94%public exploit SSVC act CVSS 9.8

Ivanti1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-22457 · Ivanti Connect Secure

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

KEV · due 11 Apr ransomware use EPSS 100%public exploit SSVC act CVSS 9.8

mitre12 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-22611 · mitre

OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \open…

EPSS 6%public exploit CVSS 9.8

CVE-2025-29064 · mitre

An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the c…

EPSS 0.8%public exploit CVSS 9.8

CVE-2025-29462 · mitre

A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13.

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-29647 · mitre

SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-26817 · mitre

Netwrix Password Secure 9.2.0.32454 allows OS command injection.

EPSS 2%CVSS 9.8

CVE-2025-26818 · mitre

Netwrix Password Secure through 9.2 allows command injection.

EPSS 1%CVSS 9.8

CVE-2025-22926 · mitre

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modul…

EPSS 0.9%CVSS 9.8

CVE-2025-29369 · mitre

Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1.

EPSS 0.7%CVSS 9.8

CVE-2025-22927 · mitre

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modul…

EPSS 0.8%CVSS 9.1

CVE-2025-22929 · mitre

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilter…

EPSS 0.5%CVSS 9.8

CVE-2025-22930 · mitre

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.

EPSS 0.5%CVSS 9.8

CVE-2025-22928 · mitre

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.

EPSS 0.4%CVSS 9.8

tauri-apps1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2025-31477 · tauri-apps plugins-workspace

Improper Scope Validation in the open Endpoint of tauri-plugin-shell

EPSS 1%public exploit CVSS 9.8

pgadmin.org2 vulnerabilities on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2025-2945 · pgadmin.org pgAdmin 4

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

EPSS 56%CVSS 9.9

CVE-2025-2946 · pgadmin.org pgAdmin 4

Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4

EPSS 0.3%CVSS 9.1

PHPGurukul5 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3138 · PHPGurukul Online Security Guards Hiring System

PHPGurukul Online Security Guards Hiring System edit-guard-detail.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-3137 · PHPGurukul Online Security Guards Hiring System

PHPGurukul Online Security Guards Hiring System changeimage.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3146 · PHPGurukul Bus Pass Management System

PHPGurukul Bus Pass Management System view-pass-detail.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3147 · PHPGurukul Boat Booking System

PHPGurukul Boat Booking System add-subadmin.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3168 · PHPGurukul Time Table Generator System

PHPGurukul Time Table Generator System edit-class.php sql injection

EPSS 0.6%public exploit CVSS 9.8

Tencent Music Entertainment1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3164 · Tencent Music Entertainment SuperSonic

Tencent Music Entertainment SuperSonic H2 Database Connection testConnect code injection

EPSS 0.7%public exploit CVSS 9.8

Project Worlds7 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3170 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System admin_user.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3171 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System approve_lawyer.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3173 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System save_booking.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3174 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System searchLawyer.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3172 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System lawyer_booking.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-3175 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System save_user_edit_profile.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-3176 · Project Worlds Online Lawyer Management System

Project Worlds Online Lawyer Management System single_lawyer.php sql injection

EPSS 0.5%public exploit CVSS 9.8

projectworlds4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3178 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System deleteappointment.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3179 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System deletepatient.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3180 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System deleteschedule.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3181 · projectworlds Online Doctor Appointment Booking System

projectworlds Online Doctor Appointment Booking System appointment.php sql injection

EPSS 0.6%public exploit CVSS 9.8

rustaurius1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-2005 · rustaurius Front End Users

Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

EPSS 22%CVSS 9.8

SourceCodester6 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-3118 · SourceCodester Online Tutor Portal

SourceCodester Online Tutor Portal view_course.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3119 · SourceCodester Online Tutor Portal

SourceCodester Online Tutor Portal manage_course.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3120 · SourceCodester Apartment Visitors Management System

SourceCodester Apartment Visitors Management System add-apartment.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3140 · SourceCodester Online Medicine Ordering System

SourceCodester Online Medicine Ordering System view_category.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3141 · SourceCodester Online Medicine Ordering System

SourceCodester Online Medicine Ordering System manage_category.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-3151 · SourceCodester Gym Management System

SourceCodester Gym Management System signup.php sql injection

EPSS 0.6%public exploit CVSS 9.8

fcba_zzm1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-3135 · fcba_zzm ics-park Smart Park Management System

fcba_zzm ics-park Smart Park Management System update sql injection

EPSS 0.4%public exploit CVSS 9.8

STMicroelectronics1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-45064 · STMicroelectronics X-CUBE-AZRT-H7RS

A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.

EPSS 1%CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.7Priority 40KEV 0

CVE-2023-40714 · Fortinet FortiSIEM

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to…

EPSS 0.7%CVSS 9.7

Linux1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-21988 · Linux Linux

fs/netfs/read_collect: add to next->prev_donated

EPSS 0.4%CVSS 9.8

Open Source Robotics Foundation1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-39780 · Open Source Robotics Foundation Robot Operating System (ROS)

Use of unsafe yaml load in dynparam

EPSS 0.4%CVSS 9.8

conda-forge1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-31484 · conda-forge infrastructure

conda-forge infrastructure uses a bad token for Azure's cf-staging access

EPSS 0.4%CVSS 9.3

Trend Micro, Inc.1 vulnerability on this pageMax CVSS 9.0Priority 35KEV 0

CVE-2025-31286 · Trend Micro, Inc. Trend Vision One

An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code.

EPSS 0.5%CVSS 9.0

reputeinfosystems1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-31911 · reputeinfosystems Social Share And Social Locker

WordPress Social Share And Social Locker plugin <= 1.4.2 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

The archive.