Archive
March 2025
Vulnerabilities first published in this month (UTC), newest first.
138 results · Clear filters · Feed
-
Critical 9.1CVE-2025-28915 Public exploit
WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through <= 1.2.9.
-
Medium 6.8CVE-2025-27591 Public exploit
Below has Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that…
-
Critical 10.0
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
KEV Mar 13, 2025 -
High 7.0
Microsoft Management Console Security Feature Bypass Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
KEV Mar 11, 2025 -
High 7.8
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
KEV Mar 11, 2025 -
High 7.3CVE-2025-24076 Public exploit
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Microsoft Windows File Explorer Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 17, 2025 -
High 8.1CVE-2025-24035 Public exploit
Windows Remote Desktop Services Remote Code Execution Vulnerability
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Redfish Authentication Bypass
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
KEV Jun 25, 2025 -
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025 -
High 7.3CVE-2025-1550 Public exploit
Arbitrary Code Execution via Crafted Keras Config for Model Loading
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and…
-
Critical 9.8
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unau…
-
Medium 6.5CVE-2021-37787 Public exploit
The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnera…
-
Low 1.8CVE-2025-27893 Public exploit
In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate imm…
-
High 7.3CVE-2025-25748 Public exploit
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized a…
-
Medium 5.4CVE-2025-25747 Public exploit
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and …
-
High 7.1CVE-2025-25749 Public exploit
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of p…
-
High 8.8CVE-2025-2135 Public exploit
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corr…
-
Medium 5.5CVE-2025-27136 Public exploit
LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document duri…
-
Critical 10.0
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…
KEV Apr 1, 2025 -
Low 3.5CVE-2025-26865 Public exploit
Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which …
-
High 8.8CVE-2025-25614 Public exploit
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the per…
-
Medium 5.4CVE-2025-25620 Public exploit
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
-
High 7.6CVE-2025-25616 Public exploit
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The af…
-
Medium 6.0CVE-2025-25615 Public exploit
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class secti…
-
Medium 6.3
JoomlaUX JUX Real Estate GET Parameter realties sql injection
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter…
-
Medium 5.6
Apache Camel: Camel Message Header Injection via Improper Filtering
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10…
-
High 7.5
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of suff…
-
Medium 6.8CVE-2025-27840 Public exploit
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
-
High 8.8CVE-2025-27607 Public exploit
Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency
Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name o…
-
Critical 9.3CVE-2025-27519 Public exploit
Cognita Arbitrary File Write
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is s…
-
High 7.7CVE-2025-27152 Public exploit
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…
-
Medium 4.8CVE-2024-9458 Public exploit
Reservit Hotel < 3.0 - Admin+ Stored XSS
The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e…
-
Medium 4.3CVE-2025-25617 Public exploit
Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
-
Critical 9.3CVE-2025-27509 Public exploit
SAML authentication vulnerability due to improper SAML response validation
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT…
-
Medium 6.5CVE-2024-57972 Public exploit
The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (W…
-
Critical 9.8CVE-2025-25763 Public exploit
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
-
Medium 6.9CVE-2025-27515 Public exploit
Laravel has a File Validation Bypass
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
-
Medium 5.3CVE-2024-8682 Public exploit
JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enable…