Critical vulnerability archive — page 364

mitre26 vulnerabilities on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2025-27364 · MITRE Caldera

In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (impl…

EPSS 26%public exploit CVSS 10.0

CVE-2025-25789 · mitre

FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.

EPSS 1%public exploit CVSS 9.8

CVE-2024-54820 · mitre

XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.

EPSS 1%public exploit CVSS 9.8

CVE-2025-25784 · mitre

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrar…

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-25790 · mitre

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitr…

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-25783 · mitre

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code v…

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-53573 · mitre

Unifiedtransform v2.X is vulnerable to Incorrect Access Control.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25516 · mitre

Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25517 · mitre

Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25519 · mitre

Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25520 · mitre

Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25521 · mitre

Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-26201 · mitre

Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass auth…

EPSS 0.6%public exploit CVSS 9.1

CVE-2024-57040 · mitre

TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded passwor…

EPSS 1%CVSS 9.8

CVE-2025-22974 · mitre

SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql paramete…

EPSS 0.8%CVSS 9.8

CVE-2024-56897 · mitre

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands.

EPSS 0.7%CVSS 9.8

CVE-2024-50688 · mitre

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials.

EPSS 0.5%CVSS 9.8

CVE-2025-25513 · mitre

Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.

EPSS 0.5%CVSS 9.8

CVE-2024-53544 · mitre

NovaCHRON Zeitsysteme GmbH & Co.

EPSS 0.4%CVSS 9.8

CVE-2024-56525 · mitre

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role ca…

EPSS 0.4%CVSS 9.8

CVE-2024-50685 · mitre

SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStati…

EPSS 0.5%CVSS 9.1

CVE-2024-50686 · mitre

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonServi…

EPSS 0.5%CVSS 9.1

CVE-2024-50689 · mitre

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService…

EPSS 0.5%CVSS 9.1

CVE-2024-50693 · mitre

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService…

EPSS 0.5%CVSS 9.1

CVE-2024-50687 · mitre

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService…

EPSS 0.4%CVSS 9.1

CVE-2025-25785 · mitre

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php.

EPSS 0.4%CVSS 9.1

LB-LINK3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-1608 · LB-LINK AC1900 Router

LB-LINK AC1900 Router set_manpwd websGetVar os command injection

EPSS 10%public exploit CVSS 9.8

CVE-2025-1609 · LB-LINK AC1900 Router

LB-LINK AC1900 Router set_cmd websGetVar os command injection

EPSS 10%public exploit CVSS 9.8

CVE-2025-1610 · LB-LINK AC1900 Router

LB-LINK AC1900 Router set_blacklist websGetVar os command injection

EPSS 13%public exploit CVSS 9.8

LabRedesCefetRJ2 vulnerabilities on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2025-27140 · LabRedesCefetRJ WeGIA

WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)

EPSS 3%public exploit CVSS 10.0

CVE-2025-27133 · LabRedesCefetRJ WeGIA

WeGIA has SQL Injection endpoint at 'dao/pet/adicionar_tipo_exame.php' parameter 'tipo_exame'

EPSS 0.6%public exploit CVSS 9.4

hzmanyun1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2025-1676 · hzmanyun Education and Training System

hzmanyun Education and Training System pdf2swf os command injection

EPSS 2%public exploit CVSS 9.8

Benner2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-1640 · Benner ModernaNet

Benner ModernaNet JS_CarregaCombo sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-1641 · Benner ModernaNet

Benner ModernaNet GetHorariosDoDia sql injection

EPSS 0.6%public exploit CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2025-1599 · SourceCodester Best Church Management Software

SourceCodester Best Church Management Software profile_crud.php path traversal

EPSS 1%public exploit CVSS 9.1

infiniflow1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-27135 · infiniflow ragflow

RAGFlow SQL Injection vulnerability

EPSS 0.6%public exploit CVSS 9.8

Mattermost3 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2025-25279 · Mattermost Mattermost

Arbitrary file read in Mattermost Boards via import & export board archive

EPSS 24%CVSS 9.9

CVE-2025-20051 · Mattermost Mattermost

Arbitrary file read via block duplication in Mattermost Boards

EPSS 0.6%CVSS 9.9

CVE-2025-24490 · Mattermost Mattermost

SQL Injection in Mattermost Boards via board category ID reordering

EPSS 0.5%CVSS 9.6

wpeverest1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-1128 · wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

EPSS 42%CVSS 9.8

FiberHome1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-1616 · FiberHome AN5506-01A ONU GPON

FiberHome AN5506-01A ONU GPON Diagnosis os command injection

EPSS 8%CVSS 9.8

Aldo Latino1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-26966 · Aldo Latino PrivateContent

WordPress PrivateContent plugin <= 8.11.5 - Unauthenticated Account Takeover vulnerability

EPSS 0.6%CVSS 9.8

flexmls1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-26900 · flexmls Flexmls® IDX

WordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Moodle Project1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-26533 · Moodle Project moodle

SQL injection risk in course search module list filter

EPSS 0.6%CVSS 9.8

Ays Pro1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-26971 · Ays Pro Poll Maker

WordPress Poll Maker <= 5.6.5 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.8

Jürgen Müller1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2025-26943 · Jürgen Müller Easy Quotes

WordPress Easy Quotes plugin <= 1.2.2 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

WPExperts.io1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2025-26974 · WPExperts.io WP Multistore Locator

WordPress WP Multi Store Locator plugin <= 2.5.1 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

jupyterhub1 vulnerability on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2023-25574 · jupyterhub ltiauthenticator

JupyterHub's LTI13Authenticator: JWT signature not validated

EPSS 0.4%CVSS 10.0

zephyrproject-rtos1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2025-1675 · zephyrproject-rtos Zephyr

Out of bounds read in dns_copy_qname

EPSS 0.4%CVSS 9.1

HCL Software1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2024-30150 · HCL Software MyCloud

An unauthenticated privilege escalation vulnerability affects HCL MyCloud

EPSS 0.3%CVSS 9.1

The archive.